Subject Access Request in Scotland

There is a genuine Scottish rule inside the Data Protection Act 2018 itself, and it is not widely known. Section 208, headed “Children in Scotland”, applies where a question arises in Scotland about whether someone under 16 has the legal capacity to exercise a data protection right or give consent. It says the person has that capacity “where the person has a general understanding of what it means to exercise the right”, and then:

“A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown.”

There is no equivalent fixed age anywhere in the law of England, Wales or Northern Ireland, where the question is decided case by case on the child’s understanding with no starting presumption. Two things follow for a family in Scotland:

• A 12-year-old can make the request themselves, and an organisation that refuses to deal with a Scottish child of that age purely because of their age is starting from the wrong place.
• A parent asking for a 12-year-old’s records may be told no, and that is not obstruction. Where the child has the capacity, the rights are the child’s to exercise, and the organisation has to consider whether releasing the file to a parent is fair to the child.

The presumption is rebuttable in both directions — it can be displaced where the contrary is shown, and a child under 12 with a general understanding still has capacity under subsection (2). It is a starting point, not a bright line.

This is where the real difficulty is. Several of the bodies that hold the most-requested records in Scotland have no counterpart in England, and sending a request to the English body wastes a month before you are told so.

• Police records — Police Scotland. One national force, not a territorial force per area. The Scottish Government’s own guidance says “you can make a subject access request to Police Scotland” and covers records including DNA samples and fingerprints. Police Scotland’s route has the address and the current timescale, and which police record do you need routes the harder cases.
• Criminal record checks — Disclosure Scotland. Not the DBS, which does not operate in Scotland. Disclosure Scotland publishes its own subject access request form, and a check for a job is a different product from a request for your data.
• Prosecution files — the Crown Office and Procurator Fiscal Service. Not the Crown Prosecution Service, which has no Scottish jurisdiction.
• Court records — the Scottish Courts and Tribunals Service. Not HM Courts and Tribunals Service.
• Prison records — the Scottish Prison Service. Not HM Prison and Probation Service.
• Health records — a territorial health board. Fourteen boards, each a body corporate in its own right, rather than trusts. Health records in Scotland works out which one holds yours.
• Social work and council records — your council. Thirty-two unitary authorities, with none of the county/district split that complicates the English picture. Social care and care files covers what those files contain.
• An employer, a bank, a shop, a landlord. No Scottish difference at all. The organisation itself, exactly as elsewhere in the UK — the directory of organisations has the published route for the larger ones.

The Scottish Government’s guidance on getting a copy of your police records names the prison service, the courts service and the Crown Office as the other bodies to ask, and carries a warning worth repeating: it is against the law for anyone, including an employer recruiting you, to require you to make a subject access request and hand over the result.

Scotland has its own parental route to a pupil’s education record, and it is not the same as the English one — nor the same as a subject access request.

Under regulation 5 of the Pupils’ Educational Records (Scotland) Regulations 2003, a parent who asks for their child’s educational record must be allowed to inspect it “within 15 school days … free of charge”, and a parent asking for a copy must be given one within the same 15 school days — “on payment of any fee that may be required”.

That fee is the trap. Regulation 9 lets the responsible body charge “such fee as they think fit”, capped at the cost of supply and at “the maximum fee which would apply to a subject access request in terms of the 1998 Act” — a cap pointing at a statute that was repealed in 2018, so the ceiling it refers to no longer exists in the form the regulation assumes.

A subject access request has no fee at all. So if you want copies rather than a viewing, and you are quoted a charge, the data protection route is free and the education route is not. Fifteen school days is usually quicker than a calendar month across a holiday, so the two routes genuinely trade off against each other — speed against cost — and it is worth knowing you have both. School records covers the equivalent English split and what an education record contains.

The UK GDPR covers living people only, so there is no subject access request for a person who has died — in Scotland as everywhere else. Access to their health records comes instead from the Access to Health Records Act 1990, which extends to Scotland.

Freedom of information does not fill the gap either: alongside the exemption for your own data, section 38(1)(d) of the Freedom of Information (Scotland) Act 2002 separately exempts “a deceased person’s health record” from FOI. The 1990 Act is the route, and it is the only one.

Getting medical records sets out who may apply under the 1990 Act, what it costs, how long it takes and what can be withheld.

Because the right is reserved, everything below applies in Scotland in exactly the terms it applies in England and Wales.

• Time limit. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.
• Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.
• Identity. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.
• How far a search has to go. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.
• Complaining. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.

Our free letter builder writes a request you can send yourself, what a subject access request is covers the mechanics, and check what you got back helps when a response looks thin.